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INTRODUCTION 

The  Range  Safety  Criteria  for  Unmanned  Air  Vehicles  (UAVs)  document 
provides  a  common  approach  for  the  Range  Commander  to  make  decisions  regarding 
UAV  flight  operations.  These  criteria  allow  the  decision-maker  to  make  an  informed  and 
defensible  risk  decision  and  provide  a  tool  to  help  answer  the  question:  "Is  this  vehicle 
safe  to  fly  on  my  range?" 

The  use  of  this  tool  depends  on  the  needs  of  the  Range  Commander.  Examples  of 
when  the  tool  might  be  used  include  First  Flight  Readiness  Reviews,  new  types  of 
missions  or  tests,  or  to  help  review  existing  procedures. 

Multiple  criteria  are  used  to  examine  flight  safety  from  the  perspective  to  ensure  a 
thorough  review.  Different  viewpoints  reduce  the  risk  of  unrecognized  hazards  and  help 
to  quickly  identify  and  isolate  deficiencies.  The  criteria  are  used  to  break  up  the  "safe  to 
fly?"  question  into  a  series  of  presuppositions: 

a.  Are  system  hazards  recognized  and  risk  controls  available? 

1.  Risk  management  criteria 

b.  How  is  this  range  vulnerable  to  these  identified  system  hazards? 

2.  Casualty  expectation  criteria 

3.  Property  damage  criteria 

4.  Midair  collision  avoidance  criteria 

c.  If  safeguards  are  needed  to  reduce  risk,  will  they  work? 

5.  Adequacy  of  safeguards  criteria 

The  five  criteria  are  described  in  the  following  sections,  along  with  the  conditions 
necessary  to  meet  the  criteria.  The  criteria  are  based  on  guidance  from  safety  specialists, 
existing  reference  standards  and  policies,  and  established  procedures.  The  supplement  to 
this  document,  “RANGE  SAFETY  CRITERIA  FOR  UNMANNED  AIR  VEHICLES 
RATIONALE  AND  METHODOLOGY,”  describes  rationale  and  methodology 
supporting  the  criteria,  as  well  as  examples,  definitions  and  alternatives  to  consider  if  the 
criteria  cannot  be  met. 


1 


RANGE  SAFETY  CRITERIA  FOR  UNMANNED  AIR  VEHICLES 


1.  RISK  MANAGEMENT  CRITERIA 

The  goal  of  risk  management  criteria  is  to  ensure  system  hazards  which  may 
affect  range  safety  are  recognized,  and  have  control  measures  available.  The  range  can 
use  this  criteria  to  review  the  range  user's  risk  management  program,  regardless  of  what 
type  of  risk  management  approach  is  used.  For  the  risk  management  criteria  to  be  met, 
the  following  conditions  must  be  satisfied: 

1.1  Hazards  Identified:  The  hazards  associated  with  the  proposed  UAV  operations 
have  been  explicitly  stated,  based  on  lessons  learned  and  hazard  analysis.  Vulnerability 
to  unidentified  risk  is  reduced  through  hazard  analysis  efforts. 

•  A  safety  history  of  the  UAV  is  available,  describing  mishap  history,  corrective 
action,  mishap  rate,  or  estimate  of  mishap  rate  and  justification. 

•  A  hazard  analysis  corresponding  in  scope  to  the  type  of  UAV  and  the  nature 
and  location  of  the  flights  has  been  performed. 

•  System  failure  modes  and  significant  hazards  are  identified. 

•  Critical  single  point  and  common  mode  failures  are  identified. 

•  Hazards  related  to  software  are  identified. 

•  Hazards  related  to  operational  and  training  issues  are  identified. 

•  Hazards  peculiar  to  the  specific  range  where  the  test  or  operation  takes  place  are 
addressed. 

•  In  the  absence  of  a  hazard  analysis,  an  independent  hazard  analysis  by  Range 
Safety,  System  Safety,  Aviation  Safety,  or  other  safety  representative  may  be 
considered. 

1.2  Hazards  Assessed:  A  hazard  analysis  or  similar  document  describes  the  level  of 
risk  associated  with  identified  hazards. 

•  The  level  of  risk  associated  with  the  hazards  has  been  identified  in  terms  of 
severity  and  probability  of  occurrence. 

•  The  probability  of  critical  single-point  and  common-mode  failure  components 
has  been  assessed. 

•  The  severity  and  probability  levels  are  valid  on  the  specific  range  where  the  test 
or  operation  will  take  place.  Hazards  assessment  has  been  reviewed  for  each  new 
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range  to  be  flown  to  ensure  risk  exposure  does  not  increase  to  an  unacceptable 
level. 

•  Hazards  which  are  "accepted  risk"  have  been  identified  as  such. 

1.3  Control  Measures  and  Risk  Decisions:  Control  measures  to  reduce  risks  to  an 
acceptable  level  are  identified. 

•  Control  measures  are  chosen  to  reduce,  mitigate,  or  eliminate  the  risk. 

•  A  review  and  decision  process  has  been  followed  for  hazards  which  exceed  the 
acceptable  level  of  risk  at  the  appropriate  level  of  management. 

1.4  Hazard  Controls:  Control  measures  identified  in  the  hazard  analysis  are 
incorporated. 

•  Safeguards  identified  in  the  hazard  analysis  are  incorporated  into  the  design,  the 
test  procedures,  or  the  operating  plan. 

•  Safety  limits  and  a  plan  to  monitor  them  are  defined. 

1.5  Supervision:  Follow-up  evaluations  of  the  control  measures  are  planned  in  order 
to  ensure  effectiveness.  Adjustments  will  be  made  before  continuing  with  the  test  or 
operation. 

•  The  range  organization  has  identified  personnel  with  the  responsibility  for 
monitoring  and  documenting  the  safety  control  measures  of  the  planned  test  or 
operation. 

•  The  assigned  safety  monitors  are  empowered  to  stop  operations  if  control 
measures  are  not  followed  or  if  safety  limits  are  exceeded. 

•  The  use  of  safety  resources  is  integrated  into  the  plan  to  monitor  safety  limits 
and  to  control  hazards. 


2.  CASUALTY  EXPECTATION  CRITERIA 

Any  UAV  operation  or  test  must  show  a  level  of  risk  to  human  life  no  greater  than  that 
for  an  operation  or  test  of  a  piloted  aircraft. 

The  hazards  associated  with  a  specific  UAV  are  defined  in  the  hazard  analysis  (risk 
management  criteria).  The  range  must  ensure  that  the  risks  to  people  identified  in  the 
hazard  analysis  are  reduced  to  an  acceptable  level.  Conducting  hazardous  operations 
away  from  populated  areas  reduces  risk  by  limiting  exposure  to  the  hazard. 
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The  criteria  is  met  if  the  hazard  is  confined  to  unpopulated  areas  (2.1)  or  if  the  combined 
vehicle  reliability  and  population  distribution  results  in  a  risk  is  no  greater  than  that  for 
manned  aircraft  operations  (2.2). 

2.1  No  Risk  to  Human  Life  Because  Hazard  is  Contained:  The  planned  route  of  flight 
is  acceptable,  because  the  flight  can  be  confined  to  unpopulated  areas.  Considerations 
include: 


•  V erification  that  the  area  is  unpopulated  through  monitoring  or  exclusion 
(fence). 

•  Recognition  of  failure  modes  which  could  result  in  the  UAV  leaving  airspace 
over  the  unpopulated  area,  and  history  of  this  vehicle  or  similar  designs 
encountering  these  failure  modes. 

•  If  necessary,  an  independent  or  highly  reliable  system  (e.g.,  Flight  Termination 
System)  is  used  to  ensure  the  vehicle  does  not  leave  assigned  airspace. 

•  Verification  that  use  of  "fly  home"  or  "emergency  mission"  software  routines 
keeps  the  vehicle  inside  the  assigned  airspace  over  unpopulated  area  boundary  on 
loss  of  control  link. 

•  System  maturity  may  or  may  not  support  requirement  for  additional  safeguards 
to  keep  the  UAV  inside  assigned  airspace. 

2.2  Equivalent  Risk  to  Manned  Aircraft:  A  prediction  of  the  average  risk  to  people 
within  the  planned  area  of flight  or  along  the  planned  route  of  flight  is  acceptable,  and 
avoidance  of  high  population  density  "hot  spots"  is  considered. 

2.2.1  Casualty  Expectation:  Must  be  less  than  one  casualty  in  a  million  flight  hours. 

•  Casualty  expectation  is  based  on  UAV  reliability  predictions  or  mishap  history, 
crash  kinetic  energy,  vehicle  dimensions,  routing,  and  population  census  data. 

•  When  empirical  data  is  not  available,  this  condition  is  met  if  the  route  is 
confined  to  sparsely  populated  areas  and  qualitative  methods  indicate  casualty 
expectation  is  negligible. 

2.2.2  Route  Selected  to  Avoid  High  Population  Density  Area:  Routes  and  altitudes 
are  selected  to  minimize  the  possibility  of  the  UA  V falling  into  a  congested  area  in  the 
event  of  electronic  or  material  malfunction.  Route  avoids  densely  populated  areas, 
especially  during  phases  of  flight  with  increased  risk. 
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•  Route  should  avoid  areas  of  high  population  density  such  as  towns,  schools, 
hospitals,  stadiums  etc.,  which  would  cause  the  momentary  casualty  expectation 
to  exceed  the  acceptable  level. 

•  Typical  critical  phases  of  flight  with  an  increase  risk  of  mishap  include  takeoff 
and  climb-out,  approach  and  landing,  and  unusual  maneuvers  that  could  cause 
structural  failure  or  loss  of  controlled  flight. 


3.  PROPERTY  DAMAGE  CRITERIA 

Identify  high  value  properties  or  high  consequence  sites  to  avoid.  This  criteria  is  met  if 
the  critical  sites  are  identified  and  a  route  is  selected  that  avoids  these  locations. 

3.1  High  Value  Property  Identified:  High  value  property  which,  if  damaged,  would 
result  in  an  unacceptable  consequence  are  identified.  Examples  include: 

•  Items  which  could  trigger  larger  hazards  if  damaged,  such  as  fuel  farms,  power 
plants,  and  ammunition  storage  sites 

•  National  assets  such  as  ground  satellite  antennas  to  national  satellite  systems, 
strategic  systems 

•  Costly  structures  such  as  expensive  range  facilities 

•  Locations  containing  Native  American  and  environmentally  sensitive  areas. 

3.2  Route  Selection:  Route  avoids  high  consequence  property,  especially  during  phases 
of  flight  with  increased  risk. 

•  Route  should  avoid  high  consequence  property  such  as  fuel  tank  farms,  nuclear 
power  plants,  etc. 

•  Examples  of  critical  phases  of  flight  with  an  increase  risk  of  mishap  include: 

•  takeoff  and  climb-out 

•  approach  and  landing 

•  unusual  maneuvers  which  could  cause  structural  failure  or  loss  of  controlled 
flight 

•  continued  flight  after  failure  of  one  leg  of  a  redundant  flight-critical 
subsystem 

•  Orbiting  over  these  sites  should  be  avoided. 
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4.  MIDAIR  COLLISION  AVOIDANCE  CRITERIA 

Collision  is  avoided  by  isolating  the  vehicle  from  other  aircraft  or  compensating 
for  differences  with  manned  aircraft  which  increase  risk  of  collision.  There  are  three 
cases  of  midair  collision  avoidance  criteria  to  accommodate  different  situations: 

•  Exclusive  Use  within  Restricted  Airspace  or  Warning  Area 

•  Shared  Use  within  Restricted  Airspace  or  Warning  Areas 

•  UAV  Operations  in  other  than  Restricted  and  Warning  Areas. 

4.1  Midair  Collision  Avoidance  Criteria:  Exclusive  Use  within  Restricted  Airspace 
or  Warning  Areas  -  The  UAV  will  be  flown  in  restricted  or  warning  areas.  Only 
aircraft  that  are  participating  in  the  UAVs  mission  or  test  event  will  be  permitted  in  the 
exclusive  airspace. 


This  criteria  is  met  if  the  UAV  is  contained  inside  restricted  airspace  or  a  warning 
area,  non-participants  are  excluded,  and  participants  are  adequately  briefed. 

4.1.1  UAV  Containment:  Assurance  that  UAV  can  be  contained  within  the  restricted 
or  warning  area  boundaries  defined.  Considerations  may  include: 

•  Recognition  of  failure  modes  which  could  result  in  the  UAV  leaving  assigned 
airspace,  and  history  of  this  vehicle  or  similar  designs  encountering  these  failure 
modes.  This  includes  consideration  of  airspace  above  and  below  the  restricted  or 
warning  area. 

•  Installation  of  a  Range  approved  independent  and  highly  reliable  system  (e.g.. 
Flight  Termination  System)  to  ensure  vehicle  does  not  leave  assigned  airspace. 

•  Verification  that  on  "loss  of  control  link,”  the  use  of  "fly  home"  or  "emergency 
mission"  software  routines  keeps  the  vehicle  inside  the  restricted  or  warning  area 
boundary  and  altitude  limits. 

•  Recognition  that  system  maturity  may  or  may  not  support  requirement  for 
additional  safeguards  to  keep  UAV  inside  assigned  airspace. 

•  Verification  that  Air  Traffic  Control  (ATC)  or  military  radar  unit  (MRU)  can 
monitor  vehicle  position  for  containment,  and  to  communicate  with  UAV 
controllers  in  a  timely  manner. 
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4.1.2  Exclusion  of  Other  Aircraft:  Assurance  that  other  aircraft  can  be  kept  out  of  the 
airspace  dedicated  to  UA  V  mission  use.  Considerations  may  include: 

•  Boundaries  of  the  restricted  airspace  or  warning  areas  are  explicitly  defined  and 
recognized  by  other  airspace  users. 

•  The  restricted  area  or  warning  area  is  activated. 

•  Where  capabilities  exist,  demonstrate  ability  to  monitor  the  airspace  within  and 
near  the  restricted  or  warning  area  and  communicate  with  traffic  which  may 
conflict. 

•  Where  monitoring  capabilities  are  limited  or  do  not  exist,  demonstrate  ability  to 
control  the  airspace  through  scheduling  or  standardized  local  procedures. 

Potential  risk  associated  with  limitations  of  the  ability  to  monitor  and 
communicate  with  traffic  in  the  restricted  or  warning  areas  must  be  recognized. 

4.1.3  Participant  Coordination:  UA  V  operators  ensure  that  flight  crews  and  ATC  (or 
MRU  controllers)  understand  the  operation  as  well  as  recognize  the  limitations  of  the 
UAV.  A  local  "standard  operating  procedure"  may  address  routine  operations.  This 
coordination  may  include: 

•  Mission  briefs,  review  of  UAV  peculiar  procedures. 

•  Flight  crews  and  ATC  following  established  and  approved  procedures  for  that 
range. 

4.2  Midair  Collision  Avoidance  Criteria:  Shared  Use  within  Restricted  Airspace  or 
Warning  Areas  -  The  UA  V  will  be  flown  in  restricted  or  warning  areas  along  with  other 
aircraft  which  may  not  be  participating  in  the  UAV’s  mission  or  test  event. 

This  criteria  is  met  if  the  UAV  is  contained  inside  restricted  airspace  or  a  warning 
area,  and  differences  between  UAVs  and  manned  aircraft  that  increase  risk  to 
other  aircraft  (e.g.  “see  and  avoid,”  response  delays,  etc.)  are  accounted  for. 

4.2.1  UAV  Containment:  Assurance  that  UAV  can  be  contained  within  the  restricted 
or  warning  area  boundaries.  Considerations  may  include: 

•  Recognition  of  failure  modes  which  could  result  in  the  UAV  leaving  the 
restricted  or  warning  area,  and  history  of  this  vehicle  or  similar  designs 
encountering  these  failure  modes.  This  includes  consideration  of  airspace  above 
and  below  the  restricted  or  warning  area. 
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•  Installation  of  a  Range  approved  independent  and  highly  reliable  system  (e.g. 
flight  termination  system)  to  ensure  vehicle  does  not  leave  assigned  airspace. 

•  Verification  that  on  "loss  of  control  link,”  the  use  of  "fly  home"  or  "emergency 
mission"  software  routines  keeps  the  vehicle  inside  the  restricted  or  warning  area 
boundary  and  altitude  limits. 

•  Recognition  that  system  maturity  may  or  may  not  support  requirement  for 
additional  safeguards  to  keep  UAV  inside  assigned  airspace. 

•  Verification  that  ATC  or  MRU  can  monitor  vehicle  position  for  containment 
and  to  communicate  with  UAV  controllers  in  a  timely  manner. 

4.2.2  Compensating  for  See  and  Avoid  Limitations:  The  see  and  avoid  limitations  of 
the  UAV  are  recognized  and  compensated  for.  For  example,  onboard  cameras  may  have 
limitations  (field  of  view,  sensitivity)  and  the  size  of  the  UAV  may  make  it  difficult  for 
other  aircraft  to  see.  Considerations  may  include: 

•  Use  of  a  chase  aircraft  to  augment  vision  of  UAV  controller  and  to  increase 
chance  of  being  seen  by  other  aircraft. 

•  Use  of  bright  colors  or  lights  to  increase  the  visibility  of  the  UAV. 

•  Use  of  radar  surveillance  in  UAV  flight  area,  and  verification  that  both 
communications  and  radar  coverage  is  adequate. 

•  Use  of  a  ground  observer  for  low  flying  UAVs. 

•  A  plan  to  actively  avoid  conflicts  which  considers  performance  the  limitations 
of  the  vehicle. 

4.2.3  Compensating  for  Delays  with  ATC  Instruction:  Vehicles  with  limited  or  no  see 
and  avoid  capability  are  dependent  on  ATC  or  MRU  for  safe  separation. 

Communication  and  control  delays  may  increase  in  comparison  with  those  of  manned 
aircraft.  Vehicle  response  must  match  airspace  conditions  and  requirements. 
Considerations  may  include: 

•  Increased  coordination  and  pre-planning  with  ATC  or  MRU. 

•  Use  of  local  established  deconfliction  procedures. 

4.3  Midair  Collision  Avoidance  Criteria:  UA  V  Operations  in  other  than  Restricted 
and  Warning  Areas  -  UAV  plans  to  enter  National  Airspace,  other  than  restricted  area  or 
warning  area.  FAA  is  responsible  for  aircraft  separation  during  Instrument  Flight  Rules 
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(IFR)  conditions,  and  is  responsible  for  regulations  regarding  aircraft  separation  in 
Visual  Flight  Rules  (VFR)  conditions.  The  FAA  must  authorize  and  approve  the  flight. 

This  criteria  is  met  with  documentation  of  FAA  approval  and  review  and  approval 
by  the  accountable  government  sponsor. 

4.3.1  FAA  Approval:  UA  Vs  which  plan  to  enter  the  National  Airspace  System  shall 
conform  with  FAA  regulations  and  gain  approval  from  the  regional  FAA  representative. 

A  Certificate  of  Authorization  is  required. 

4.3.2  DoD  /  NASA  Review:  Government  sponsor  (i.e.  the  DoD  or  NASA)  must  also 
review  and  approve  if  there  is  any  DoD  or  NASA  liability.  FAA  Notice  7610. 71  states: 
"The  proponent  and/or  its  representative  shall  be  noted  as  responsible  at  all  times  for 
collision  avoidance  maneuvers  with  nonparticipating  aircraft  and  the  safety  of  persons  or 
property  on  the  surface. "  Differences  between  UAVs  and  manned  aircraft  (e.g.,  “see  and 
avoid,  ”  response  delays)  must  be  accounted  for. 

4.3.2.1  UAV  Containment:  Assurance  that  the  UAV  can  be  contained  within  the 
boundaries  of  the  pre-planned  route  of flight  defined  in  the  flight  plan  and  approved  by 
the  FAA.  Considerations  may  include: 

•  Recognition  of  failure  modes  which  could  result  in  the  UAV  leaving  the 
assigned  route  of  flight  or  assigned  altitude  limits,  and  history  of  this  vehicle  or 
similar  designs  encountering  these  failure  modes. 

•  Installation  of  a  Range  approved  independent  and  highly  reliable  system  (e.g., 
flight  termination  system)  to  ensure  vehicle  does  not  leave  assigned  route  of 
flight. 

•  Verification  that  on  "loss  of  control  link,”  use  of  "fly  home"  or  "emergency 
mission"  software  routines  keep  the  vehicle  on  its  assigned  route  and  within  its 
assigned  altitude  limits. 

•  Verification  that  the  use  of  "fly  home"  or  "emergency  mission"  software 
routines  will  not  increase  risk  to  other  aircraft  or  persons  on  the  ground  due  to  loss 
of  control  link. 

•  Recognition  that  system  maturity  may  or  may  not  support  requirement  for 
additional  safeguards  to  keep  the  UAV  on  assigned  route  and  within  assigned 
altitude  limits. 

•  Verification  that  ATC  can  monitor  vehicle  position  and  communicate  with 
UAV  controllers  in  a  timely  manner. 
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4.3. 2.2  Compensating  for  See  and  Avoid  Limitations:  The  limitations  of  the  UAV are 

recognized  and  compensated  for .  F or  example,  onboard  cameras  may  have  limitations  ( 
field  of  view,  sensitivity)  and  the  size  of  the  UA  V  may  make  it  difficult  for  other  aircraft  to 
see.  Considerations  may  include: 

•  Use  of  a  chase  aircraft  to  augment  vision  of  UAV  controller  and  to  increase 
chance  of  being  seen  by  other  aircraft. 

•  Use  of  bright  colors  or  lights  to  increase  the  visibility  of  the  UAV. 

•  Use  of  radar  surveillance  in  UAV  flight  area. 

•  Use  of  a  ground  observer  for  low  flying  UAVs 

•  A  plan  to  actively  avoid  conflicts  which  considers  the  performance  limitations 
of  the  vehicle. 

4.3.2.3  Compensating  for  Delays  with  ATC  Instruction:  Vehicles  with  limited  or  no 
see  and  avoid  capability  are  dependent  on  ATC  for  safe  separation.  Communication  and 
control  delays  may  increase  in  comparison  with  those  of  manned  aircraft.  Vehicle 
response  must  match  airspace  conditions  and  requirements.  Considerations  may  include: 

•  Increased  coordination  and  pre-planning  with  ATC. 

•  Use  of  FAA  established  deconfliction  procedures. 


5.  CRITERIA  FOR  RELIABILITY  AND  ADEQUACY  OF  SAFEGUARDS 

There  must  be  evidence  to  show  that  required  safeguards  will  mitigate  critical  hazards. 
Safeguards  must  be  provided  if  the  hazard  analysis  requires  it  or  if  the  UAV  or  test 
operation  does  not  meet  other  safety  criteria  (e.g.  casualty  expectation,  property  damage, 
collision  avoidance)  without  it. 

Typical  systems  that  may  be  considered  as- safeguards  include,  but  are  not  limited  to: 
Emergency  remote  pilots 
Flight  termination  systems 
Software  "fly  home"  routines 
Parachutes 

Additional  guidance  is  provided  below. 
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5.1  Hardware  Safeguards:  Evidence  shows  that  the  reliability  of  required  hardware 
safeguards  are  adequate.  The  range  may  require  one  or  more  of  the  following: 

•  Evidence  reliability  is  0.999  at  95%  confidence  level  in  a  representative 
environment. 

•  Verification  the  FTS  subsystems  meet  the  current  RCC  flight  termination 
standard  (i.e.  RCC  Document  319-99  or  equivalent) 

•  Proof  the  safeguard  subsystem  meets  an  established  reliability  standard  for  that 
type  of  safeguard. 

•  Evidence  the  system  or  safeguard  has  been  tested  and  can  be  monitored  in  flight 
or  will  be  explicitly  checked  before  flight. 

5.2  Software  Safeguards:  Evidence  shows  that  the  reliability  of  required  software 
safeguards  is  adequate.  Examples  of  software  safeguards  may  include  “fly  home  ”  or 
"emergency  mission  "  routines  in  the  event  of  lost  link,  and  some  “emergency  remote 
pilot  ”  components. 

•  Software  used  in  safeguard  functions  must  show  evidence  of  an  approved 
software  safety  program  by  which  software  hazard  analysis  has  been  performed. 

•  Hazard  control  measures  identified  in  the  software  hazard  analysis  have  been 
implemented  and  are  adequate. 

5.3  Procedural  Safeguards:  Evidence  shows  procedural  safeguards  are  adequate. 
Examples  of  procedural  safeguards  are  emergency  procedures,  checklists,  operator 
certification,  and  training. 

•  Operator  procedures,  which  will  be  used  as  a  safeguard,  must  be  documented, 
reviewed,  and  approved  by  the  Range  Commander  or  delegated  representative. 
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CRITERIA  CHECKLIST 
1.  RISK  MANAGEMENT  CRITERIA 

For  the  risk  management  criteria  to  be  met,  the  following  conditions  must  be  satisfied: 


Condition 

condition  met  /  not  met  / 
comment 

1.1  Hazards  Identified:  The  hazards  associated  with 
the  proposed  UA  V  operations  have  been  explicitly 
stated,  based  on  lessons  learned  and  hazard  analysis. 
Vulnerability  to  unidentified  risk  is  reduced  through 
hazard  analysis  efforts. 

1.2  Hazards  Assessed:  A  hazard  analysis  or  similar 
document  describes  the  level  of  risk  associated  with 
identified  hazards. 

1.3  Control  Measures  and  Risk  Decisions:  Control 
measures  to  reduce  risks  to  an  acceptable  level  are 
identified. 

1.4  Hazard  Controls:  Control  measures  identified  in 
the  hazard  analysis  are  incorporated. 

1.5  Supervision:  Follow-up  evaluations  of  the  control 
measures  are  planned  in  order  to  ensure  effectiveness. 
Adjustments  will  be  made  before  continuing  with  the  test 
or  operation. 

12 


RANGE  SAFETY  CRITERIA  FOR  UNMANNED  AIR  VEHICLES 


CRITERIA  CHECKLIST 

2.  CASUALTY  EXPECTATION  CRITERIA 

The  criteria  is  met  if  the  hazard  is  confined  to  unpopulated  areas  (2.1)  or  if  the 
combined  vehicle  reliability  and  population  distribution  results  in  a  risk  no  greater  than 
manned  aircraft  operations  (2.2). 


Condition 

condition  met  /  not  met  / 
comment 

2.1  No  Risk  to  Human  Life  Because  Hazard  Is 
Contained:  The  planned  route  of  flight  is  acceptable, 
because  the  flight  can  be  confined  to  unpopulated  areas. 

2.2  Equivalent  Risk  to  Manned  Aircraft: 

(2.2.1 )  Casualty  Expectation  less  than  one  casualty  in  a 
million  flight  hours. 

2.3  Equivalent  Risk  to  Manned  Aircraft:  (2.2.2) 
Routes  and  altitudes  are  selected  to  minimize  the 
possibility  of  the  UA  V falling  into  a  congested  area  in 
the  event  of  electronic  or  material  malfunction.  Route 
avoids  densely  populated  areas,  especially  during 
phases  of  flight  with  increased  risk. 

3.  PROPERTY  DAMAGE  CRITERIA 

This  criteria  is  met  if  the  critical  sites  are  identified  and  a  route  is  selected  to  avoid 
vulnerable  locations. 


Condition 

condition  met  /  not  met  / 
comment 

3.1  High  Value  Property  Identified:  High  value 
property  which  if  damaged  would  result  in  an 
unacceptable  consequence  are  identified. 

3.2  Route  Selection:  Route  avoids  high  consequence 
property,  especially  during  phases  of  flight  with 
increased  risk. 
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CRITERIA  CHECKLIST 

4.  MIDAIR  COLLISION  AVOIDANCE  CRITERIA 

There  are  three  cases  of  midair  collision  avoidance  criteria  to  accommodate 
different  situations.  Consider  those  cases  which  apply: 

4.1  Midair  Collision  Avoidance  Criteria:  Exclusive  Use  within  Restricted  Airspace 
or  Warning  Areas  -  This  criteria  is  met  if  the  UA  V  is  contained  inside  restricted 
airspace  or  a  warning  area,  non-participants  are  excluded,  and  participants  are 
adequately  briefed. 


Condition 

condition  met  /  not  met  / 
comment 

4.1.1  UAV  Containment:  Assurance  that  UAV can  be 
contained  within  the  boundaries  defined  as  restricted 
airspace. 

4.1.2  Exclusion  of  Other  Aircraft:  Assurance  that 
other  aircraft  can  be  kept  out  of  the  airspace  dedicated 
to  UA  V  mission  use. 

4.1.3  Participant  Coordination:  UAV  operators 
ensure  flight  crews  and  ATC  (or  MRU  controllers) 
understand  the  operation  as  well  as  recognizing  the 
limitations  of  the  UA  V. 

4.2  Midair  Collision  Avoidance  Criteria:  Shared  Use  within  Restricted  Airspace  or 
Warning  Areas  -  Meet  the  following  conditions: 


Condition 

condition  met  /  not  met  / 
comment 

4.2.1  UAV  Containment:  Assurance  that  UAV  can  be 
contained  within  the  restricted  or  warning  area 
boundaries. 

4.2.2  Compensating  for  See  and  Avoid  Limitations: 

The  see  and  avoid  limitations  of  the  UA  V  are 
recognized  and  compensated  for. 

4.2.3  Compensating  for  Delays  with  ATC 

Instruction:  Vehicles  with  limited  or  no  see  and  avoid 
capability  are  dependent  on  ATC  or  military  radar  unit 
(MRU)  for  safe  separation.  Communication  and 
control  delays  may  increase  in  comparison  with  those  of 
manned  aircraft.  Vehicle  response  must  match  airspace 
conditions  and  requirements. 
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CRITERIA  CHECKLIST 

4.3  Midair  Collision  Avoidance  Criteria:  UAV  Operations  in  other  than  Restricted 
and  Warning  Areas  -  Meet  the  following  conditions: 


Condition 

condition  met  /  not  met  / 

comment 

4.3.1  FAA  Approval:  UAVs  which  plan  to  enter  the 
National  Airspace  System  shall  conform  with  FAA 
regulations  and  gain  approval  from  the  regional  FAA 
representative.  A  Certificate  of  Authorization  is 
required. 

4.3.2. 1  UAV  Containment:  Assurance  that  UAV  can 
be  contained  within  the  boundaries  of  the  pre-planned 
route  of  flight  defined  in  the  flight  plan  and  approved  by 
the  FAA. 

4.3.2.2  Compensating  for  See  and  Avoid 

Limitations:  The  limitations  of  the  UAV  are 
recognized  and  compensated  for. 

4.3.2.3  Compensating  for  Delays  with  ATC 
Instruction:  Vehicles  with  limited  or  no  see  and  avoid 
capability  are  dependent  on  ATC  for  safe  separation. 
Communication  and  control  delays  may  increase  in 
comparison  with  those  of  manned  aircraft.  Vehicle 
response  must  match  airspace  conditions  and 
requirements. 

5.  CRITERIA  FOR  RELIABILITY  AND  ADEQUACY  OF  SAFEGUARDS 
5.1  Hardware  Safeguards:  The  range  may  require  one  or  more  of  the  following: 


Condition 

condition  met  /  not  met  / 

comment 

Evidence  reliability  is  0.999  at  95%  confidence  level  in 
a  representative  environment. 

Proof  FTS  subsystems  meet  the  current  RCC  Flight 
Termination  System  standard  (i.e.,  RCC  Document  319- 
99  or  equivalent). 

Verification  the  safeguard  subsystem  meets  an 
established  reliability  standard  for  that  type  of  safeguard. 

Evidence  the  system  or  safeguard  has  been  tested  and 
can  be  monitored  in  flight  or  will  be  explicitly  checked 
before  flight. 
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CRITERIA  CHECKLIST 

5.2  Software  Safeguards:  Meet  both  of  the  following  conditions: 


Condition 

condition  met  /  not  met  / 
comment 

Software  used  in  safeguard  functions  must  show 
evidence  of  a  software  safety  program  in  which  software 
hazard  analysis  has  been  performed. 

Hazard  control  measures  identified  in  the  software 
hazard  analysis  have  been  implemented  and  are 
adequate. 

5.3  Procedural  Safeguards:  Meet  both  of  the  following  conditions: 


Condition 

condition  met  /  not  met  / 
comment 

Operator  procedures,  which  will  be  used  as  a  safeguard, 
must  be  documented. 

Procedures  must  have  been  reviewed  and  approved  by 
the  Range  Commander  or  delegated  representative. 
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